Description
We allow anyone (even unauthenticated users) to download a file if they know its S3 object key. These keys are generated using a combination of user_id + UUID, making them random and hard to guess. However, once someone has access to a key, they can download the file indefinitely without additional checks.
This behavior may be acceptable in certain applications where files should be publicly accessible once their key is known. However, some use cases may require additional access controls, such as authentication or permission checks.
TODO:
- Clearly document the current behavior in the project documentation.
- Explain that S3 object keys alone provide access without further authorization checks.
- Outline possible alternative approaches for stricter access control (e.g., authentication and/or authorization checks before access).
- Consider and discuss potential use cases where this behavior is acceptable or might need modification.
This is not considered a security issue but rather a design choice that should be explicitly documented.
We should evaluate whether additional options should be provided for more restrictive access control.
BOUNTY HUNTER PRICE TAG: $50
paid once PR is merged